Menu
This question seems duplicate, but after some research, no solid answer is found. The sub questions are:
http-equiv and HTTP response header have the same key, and their corresponding value conflict, which one takes precedence?Here are some research work:
http-equiv="set-cookie", in which case real HTTP response header takes precedence).Content-Type
http-equiv takes precedence for X-UA-Compatible
In my opinion, either decision makes sense, but isn't there a general answer?
478
The response-header fields allow the server to pass additional information about the response which cannot be placed in the Status- Line. These header fields give information about the server and about further access to the resource identified by the Request-URI.
A response header is an HTTP header that can be used in an HTTP response and that doesn't relate to the content of the message. Response headers, like Age , Location or Server are used to give a more detailed context of the response.
Request headers contain more information about the resource to be fetched, or about the client requesting the resource. Response headers hold additional information about the response, like its location or about the server providing it.
The http-equiv attribute provides an HTTP header for the information/value of the content attribute. The http-equiv attribute can be used to simulate an HTTP response header.
From the documentation it is not clear what is the precedence of Content-Security-Policy in http-equiv vs. http header. I have tested experimentaly on Firefox 62.0:
<meta http-equiv="Content-Security-Policy" content="script-src 'self' https://www.google-analytics.com/analytics.js"/>
<script src="https://www.google-analytics.com/analytics.js"></script>
<script src="https://connect.facebook.net/en_US/fbevents.js"></script>
When HTTP header is not set, the console argues about facebook.net only.
With header set Content-Security-Policy "script-src 'self' https://connect.facebook.net/en_US/fbevents.js"
the console argues about both www.google-analytics.com and facebook.net.
When http-equiv is removed and header for facebook.net kept, the console correctly argues about google-analytics.
From that it seems the combination of http-equiv and http header is detected as duplicate definition and not recognized at all.
75
from MSDN:
If both of these instructions are sent, the developer's preference (meta element) takes precedence over the web server setting (HTTP header).
I couldn't find whether it is IE\IIS specific behavior, or a standard.
1
The answer posted by Shahafo may be correct for the X-UA-Compatible header and IE 11, but does not appear to be true in the general case. For example, for Firefox and Chrome, caching-related HTTP headers have a higher precedence than caching-related http-equiv tags. For IE 11, the situation is reversed.
1
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
